Gradient-Free and Prior-Free Jailbreaking of Large Language Models: Effective and Transferable Attacks
Jailbreaking LLMs Without Gradients or Priors: Effective and Transferable Attacks
Researchers propose a jailbreak optimization framework RAILS that requires no gradients and no human priors, using only model logits for token-level iterative local search. The method enforces exact prefix matching with an autoregressive loss and uses history-based candidate selection to bridge the gap between the surrogate objective and true attack success rate. On HarmBench, RAILS achieves 100% attack success rate on Vicuna, Qwen, and Baichuan2, and 90.2% on Llama2, higher than GCG's 43.9%. After ensemble optimization with Llama2, Vicuna, and Qwen, transfer success rates to GPT-3.5 Turbo, Gemini Pro 1.5, and GPT-4 Turbo are 82.9%, 51.2%, and 22.0%, respectively. The authors state that under a perplexity threshold that would filter out 5% of real user prompts, RAILS still maintains a 38% success rate on Llama2.
论文给出无需梯度与人工先验的越狱优化方法，并在开源与闭源模型上报告攻击成功率与迁移数据，可供红队方法对照。